Skip to content
PentAGI
All posts

Updated VXControl team4 min read

PentAGI 2.2: more models, failover and one web search tool

Mistral, xAI and MiniMax join the built-in providers, a failed model call moves to a fallback provider, and one search tool picks the engine for agents.

  • release
  • open-source

PentAGI 2.2 is the new open-source release. Most of it is about keeping long autonomous runs on track: more models to choose from, a second provider when the first one fails, requests that fit the model's context window, and one search tool instead of one per engine. It also closes CVE-2026-14784, a host takeover through the sandbox — see Tighter control over the sandbox.

More model providers

Mistral, xAI and MiniMax are now built in, next to OpenAI, Anthropic, Google Gemini, AWS Bedrock, Ollama, DeepSeek, GLM, Kimi and Qwen. Azure OpenAI deployments and the OpenCode Go plan work through the custom provider, with example configurations in examples/configs/.

Every model catalog now states the context window and output limit its vendor publishes. PentAGI measures each request against the window before sending it and compacts the chain to fit, instead of waiting for the vendor to reject it.

Provider failover

A provider outage used to end the agent chain. Set LLM_FALLBACK_PROVIDER and a failed call is repeated on that provider; every call still starts on the flow's own provider, so a recovered provider is used again right away. The switch is recorded on the trace, not only in the log.

LLM_FALLBACK_PROVIDER=anthropic   # name of another configured provider

One web search tool

Agents now search through a single web_search tool. They ask for links, an answer, deep research or exploit code, and the tool picks the best configured engine, retries transient failures and falls back to another engine on its own.

Firecrawl joins the engines, and an optional internal engine (WEB_SEARCH_INTERNAL_ENABLED) opens result pages in PentAGI's own isolated browser and summarizes them; for answers, research and exploits it is tried after Tavily, Firecrawl and Perplexity and before Traversaal.

Keyless Anthropic

Anthropic can authenticate with Workload Identity Federation instead of a long-lived API key: fill in the ANTHROPIC_FEDERATION_RULE_ID, organization, service account and workspace IDs and point ANTHROPIC_IDENTITY_TOKEN_FILE at the identity token mounted into the container.

Tighter control over the sandbox

  • DOCKER_ALLOWED_IMAGES limits the images the model may pick for a flow, and DOCKER_IMAGE_SELECTION_MODE=fixed always uses the pentest image.
  • Up to 2.1, DOCKER_INSIDE=true — the default of the old .env template — mounted the host Docker socket into every sandbox, so an agent steered by prompt injection could take over the host. Sandboxes now drop all capabilities except an allow-list, and agents get Docker only from a separate daemon set in DOCKER_INSIDE_HOST; without it they get none. Leave DOCKER_SOCKET empty next to it, or the template's /var/run/docker.sock is still mounted. A sandbox that is still running keeps its old mount, so finish the flows started before the upgrade.
  • Stopping a flow now ends the commands its tasks started in the sandbox, background ones included; commands started from the assistant keep running until you finish the flow. The container and its files stay for the next command.
  • TENANT_ID lets several PentAGI instances share one PostgreSQL server, worker node, Neo4j and observability stack by namespacing schemas, sandbox containers, Graphiti group IDs, cookies and telemetry. Host ports are not namespaced: instances whose sandboxes run on the same Docker host need their own DOCKER_PORTS_BASE. Leave TENANT_ID empty on an existing installation — setting it points the instance at a new, empty schema.

Version notices

The sidebar shows the version you run and tells you when a newer build is available. For this the server reports its version and a summary of the installation — counts and types, no flow content — with its installation ID to update.pentagi.com. It is on after the upgrade; UPDATE_CHECK_INTERVAL=0 turns it off, and Update check lists what is sent.

Upgrade

Back up the database first, then follow Upgrading, which lists everything to check when you move from 2.1. In short:

  • Before you upgrade with Google or GitHub sign-in on, turn it off: a provider-verified email now signs into the existing account with that address. Once 2.2 runs, move the built-in [email protected] to your own address and turn sign-in back on.

  • With the installer, download the 2.2 build, change a setting so that Apply Changes appears, answer y when it lists the out-of-date files, then run Update PentAGI. Update PentAGI alone pulls the new images but keeps the old compose files, so the new settings never reach the container.

  • With a hand-made Docker Compose setup, download the new docker-compose.yml and the file of each optional stack you run — the container receives only the variables its compose file lists — create the Bedrock provider file it now mounts, and restart:

    curl -O https://raw.githubusercontent.com/vxcontrol/pentagi/main/docker-compose.yml
touch example.bedrock.provider.yml
docker compose pull && docker compose up -d

  • Everyone signs in again, and API tokens no longer manage users, roles and tokens.

  • The custom provider now needs LLM_SERVER_KEY, and the flows started before the upgrade keep their old sandboxes until you finish them.

The full list of changes is in the release notes on GitHub.